Greetings @germeister18,
You have a few options since your goal is not 100% clear. If you want to see which hosts that have Splunk forwarders haven't sent an event in X minutes, use this:
| metadata type=hosts
| convert ctime(recentTime) as "Last Time Event Indexed"
| where recentTime < now()-(60*X)
| sort -recentTime
| table host "Last Time Event Indexed"
If you set the time selector to Last 7 days, it will show all hosts that reported in the last 7 days but not in the past X minutes.
If you want the actual uptime, you'll want the Splunk Add-on for Microsoft Windows on your search head, indexers, and each host with a Splunk forwarder. You will then create an inputs.conf in the local directory of each forwarder (hopefully using the deployment server) which enables Windows event codes. Once that's up and working, this will be your search to get the latest uptime reported by Windows to Splunk:
index=YourIndex sourcetype="WinEventLog" EventCode=6013
| dedup host
| rex field=Message "uptime is (?<Uptime_Seconds>\d+) seconds"
| table host Uptime_Seconds
| eval Uptime_Hours = round(Uptime_Seconds/60/60)
The last option will also require the Windows add-on. You can do a similar query for EventCodes 6005, 6006, and 6008 to determine uptime yourself. Those are the Event Codes for Windows start ups, and expected and unexpected shutdowns. See here: https://answers.splunk.com/answers/143636/graphing-windows-system-from-uptime-to-downtime.html
Cheers,
Jacob
Cheers,
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
